An ethereum account I had has been hacked, where whenever I send it, say, 0.1 eth, some evil bot immediately sends 0.0009 eth from that account to a dummy account, and then spends the remaining 0.0991 eth in gas. I'm not sure how they are monetizing that, but clearly, someone has the private key.

The hack can be seen at https://etherscan.io/address/0xd7184fafc2b4337e49fd059ca9fd04a98b63537a Note the outbound transactions to 0x7BF...576 and 0xE469...c5b, where the amount is small but the transaction fee is large.

I had been using that hacked account in a python file that sent data to an ethereum contract using a private key. It had sent transactions to the ethereum address, and so perhaps people could intercept its private key. Also, people could see everything but my_wallet_private_key, as I had all the other info (infura project ID, contract address) on github, where the file was available. The code I had was as follows:

infura_url = "https://mainnet.infura.io/v3/myinfuraProjectID"
w3 = Web3(HTTPProvider(infura_url))
contract = w3.eth.contract(address=contract_address, abi=contract_abi['abi'])
nonce = w3.eth.getTransactionCount(my_wallet_address)
txn_dict = contract.functions.updateMyMethod(x, y).buildTransaction({
      'gas': 100000,
      'gasPrice': w3.toWei(gas_p, 'gwei'),
      'nonce': nonce,
signed_txn = w3.eth.account.signTransaction(txn_dict, private_key=my_wallet_private_key)
result = w3.eth.sendRawTransaction(signed_txn.rawTransaction)

I suspect that this is insecure because this is the only way I can fathom someone got this private key (eg, they didn't get the private keys to other accounts based on that seed phrase). But, I'm guessing. Should I be using sendSignedTransaction? Was it a mistake to show my infura Project ID?

  • Please post your account address, so that we can view on etherscan those "bot-transactions" that you're mentioning, Mar 5 '20 at 5:23
  • "Was it a mistake to show my infura Project ID?" - not a critical mistake. If it gets used a lot (by other people of course), then Infura might rate-limit you at some point. They don't do that as of yet afaik, and even if they did, you can always just create a new project ID. Mar 5 '20 at 5:25
  • I added the account info in the text above Mar 5 '20 at 5:32
  • This is YOUR account? Seems like the 0.01 Ether that you've mentioned is transferred TO it, not FROM it. Mar 5 '20 at 5:36
  • And BTW, I see on etherscan the sends 0.0009 eth part, but not the spends the remaining 0.0991 eth in gas part. Mar 5 '20 at 5:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.